CVE-2024-36940

What it actually does

Double free of the pctldev struct in pinctrl_enable() due to devm-managed allocation being freed again by devm_pinctrl_dev_release(), resulting in memory corruption.

Why it matters to the business

Local attackers on affected Linux systems can trigger crashes or potential privilege escalation, leading to downtime and remediation effort on servers and devices using the kernel; the issue has been known for over two years with low exploit probability.

How an attack unfolds

An attacker with local access invokes pinctrl_enable() on a registered pinctrl device, triggering the double free of the pctldev structure and its associated pindescs and mutex, which can be leveraged for use-after-free exploitation to corrupt kernel memory.

How to fix it

Upgrade the Linux kernel to a version containing commit 735f4c6b6771eafe336404c157ca683ad72a040d or later; for affected Apache Dolphinscheduler deployments update to version 3.0.2 or apply equivalent fixes.

How to confirm the fix worked

Verify the running kernel contains the referenced commit or a backport that removes the erroneous kfree in pinctrl_enable(); confirm via source inspection or kernel build logs that devm_pinctrl_dev_release() is the sole release path.

Typical attack path

1. Obtain local user access on a vulnerable Linux system
2. Trigger pinctrl registration and enable paths through device or driver interactions
3. Cause the double free in pinctrl_enable()
4. Exploit resulting memory corruption for privilege escalation or denial of service

How to detect it

Review kernel logs for double-free warnings or use-after-free crashes referencing pinctrl_enable or pctldev; inspect for unexpected process terminations or memory corruption indicators after pinctrl device operations.

What your security team should do

• Apply the kernel fix immediately on all systems where local untrusted users may execute code
• Monitor for kernel oops or panics involving pinctrl structures
• Restrict local access where possible until patches are deployed